About this policy
ConceptFox ("we", "us") operates conceptfox.ca. This policy explains what personal information we collect when you use the site, why we collect it, how we protect it, and your rights under Quebec's Loi 25 (Act respecting the protection of personal information in the private sector) and the federal Personal Information Protection and Electronic Documents Act (PIPEDA).
Effective May 23, 2026.
Person in charge of personal information
Under Loi 25, every organization must designate a person responsible for the protection of personal information. For ConceptFox, that person is:
ConceptFox — Privacy Officer — [email protected]
You can reach them at any time to exercise the rights described below, ask a question, or file a complaint.
What we collect
- Information you provide through our contact form (name, email, the message itself).
- Information required to fulfill an order (name, email, billing details, the items or services ordered). Payment is processed by Stripe; we never see or store your card number.
- Technical information automatically logged on every request: the IP address (hashed with a per-site salt before storage), the page requested, the time, and the user-agent. We log this for security and abuse prevention only.
Why we collect it
We use the information above only for the purpose you provided it. Contact-form messages are used to answer you. Order details are used to fulfill the order and meet our legal record-keeping obligations. Security logs are used to detect and prevent abuse. We do not sell your personal information to anyone, and we do not share it with third parties for their own marketing purposes.
Where your data is stored
The site is hosted by ConceptFox-managed Canadian infrastructure, in Canada. Where possible, your data stays within Canada. If a service we rely on (for example, Stripe for payments or our email provider) processes information outside Canada, we have reviewed that service's privacy practices and chosen providers that meet or exceed Loi 25 standards.
How long we keep it
- Contact-form messages: kept for 365 days, then deleted unless an active conversation requires keeping them longer.
- Order records: kept for 2555 days for tax, accounting, and customer-service obligations, then archived or deleted.
- Security and access logs: kept for 90 days, then rotated and deleted.
Your rights
- Loi 25 and PIPEDA give you the right to:
- Access the personal information we hold about you.
- Have it corrected if it is incorrect or out of date.
- Have it deleted, where we are not legally required to keep it.
- Receive a copy in a structured, commonly-used digital format (data portability).
- Withdraw consent at any time, for any purpose where consent was the basis for processing.
- Be informed if your data is used in any automated decision-making.
- File a complaint with us, and with the Commission d'accès à l'information du Québec if you are not satisfied with our response.
- To exercise any of these rights, contact the person named above. We respond to access and correction requests within 30 days.
Security
We use industry-standard safeguards to protect your information: TLS encryption for everything in transit, hashed IP addresses for any logging, a strict content-security-policy, rate limiting against abuse, and regular security patches. Despite our efforts, no system on the internet is perfectly secure — if a confidentiality incident occurs, we will notify you and the Commission d'accès à l'information without delay, as required by Loi 25.
Changes to this policy
If we materially change this policy, we will update the effective date above and, if your existing consent no longer covers the new processing, re-prompt you through the cookie banner.